Ecovacs Robotics
Monthly
WebSocket authentication failure in Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes private key material through network traffic analysis, enabling a man-in-the-middle attacker to decrypt and tamper with the device's WebSocket communications. Both affected models implement CWE-327 (broken or risky cryptographic algorithm) in their WebSocket authentication layer, meaning the key exchange or storage mechanism does not adequately protect the session secret from passive or active interception. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but a vendor firmware update was published on March 31, 2026, referenced via the hellohas.co.jp advisory.
Enabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-accessible shell interface that authenticated low-privilege users can leverage to log into the device. Rooted in CWE-489 (Active Debug Code), the telnet daemon was never disabled before shipping production firmware, leaving a legacy unencrypted remote access protocol open on the device. Reported by JPCERT/CC with a CVSS 4.0 score of 8.7, no public exploit code or CISA KEV listing has been identified, though the network-accessible nature and low attack complexity represent meaningful risk in home and SMB environments.
Unauthenticated remote access to a production-enabled debug web server on Ecovacs DEEBOT PRO M1 and K1VAC robot vacuums exposes sensitive floor map data and operational logs to any network-reachable attacker. The flaw (CWE-489: Active Debug Code) means the devices ship with a debugging HTTP interface left enabled, serving home layout and usage data without any authentication gate. No active exploitation has been confirmed and no public exploit exists, but the CVSS 4.0 score of 8.7 reflects the high real-world privacy impact of floor plan exposure - a detailed map of a victim's home interior.
Remote unauthenticated control of Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums is possible due to an incorrectly implemented authentication algorithm in their WebSocket communications interface. Any network-reachable attacker can connect to and issue operational commands to affected robots without valid credentials (AV:N, PR:N per CVSS vector). No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Man-in-the-middle interception of ECOVACS PRO app traffic is possible due to improper TLS server certificate validation (CWE-295) in both the Android and iOS versions of the application, published by ECOVACS Robotics and coordinated by JPCERT under JVNVU92804348. An attacker with a network-positioned MITM capability can present a rogue certificate that the app accepts without proper validation, enabling retrieval and alteration of all app-server communications, which may include device control commands, account credentials, and home telemetry. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Weak Wi-Fi hotspot credentials on Ecovacs DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums allow a physically proximate attacker to recover the access point password through analysis, then connect to the robot's local network interface. Reported by JPCERT/CC via JVN advisory JVNVU92804348, this affects all firmware versions of both models per CPE data. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low exploitation complexity combined with zero required privileges makes unauthorized Wi-Fi access straightforward for any attacker within radio range.
Weak preconfigured root credentials on Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robotic vacuum cleaners expose the root account to compromise via physical access. An attacker who obtains physical access to an affected device can recover the root password, gaining privileged control over the embedded Linux system. Reported by JPCERT and disclosed via JVN advisory JVNVU92804348, no public exploit code exists and no active exploitation has been confirmed at time of analysis.
Improper TLS certificate validation in Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums exposes both devices to man-in-the-middle interception and manipulation of all outbound wget communications. Because certificate verification is disabled, a network-positioned attacker can impersonate any remote server the device contacts, injecting malicious content the device will accept and act upon. Per the vendor description, successful exploitation may result in arbitrary code execution with administrative privileges on the device; no public exploit has been identified at time of analysis.
Improper certificate validation in DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes MQTT communications to man-in-the-middle interception, allowing unauthenticated network-positioned attackers to retrieve operation logs and activity logs stored on the devices. Both models from Ecovacs Robotics fail to verify server certificates during MQTT sessions, meaning a rogue server can impersonate the legitimate cloud backend without detection. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor advisory with remediation guidance was published on 2026-03-31 as referenced by JPCERT.
WebSocket authentication failure in Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes private key material through network traffic analysis, enabling a man-in-the-middle attacker to decrypt and tamper with the device's WebSocket communications. Both affected models implement CWE-327 (broken or risky cryptographic algorithm) in their WebSocket authentication layer, meaning the key exchange or storage mechanism does not adequately protect the session secret from passive or active interception. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but a vendor firmware update was published on March 31, 2026, referenced via the hellohas.co.jp advisory.
Enabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-accessible shell interface that authenticated low-privilege users can leverage to log into the device. Rooted in CWE-489 (Active Debug Code), the telnet daemon was never disabled before shipping production firmware, leaving a legacy unencrypted remote access protocol open on the device. Reported by JPCERT/CC with a CVSS 4.0 score of 8.7, no public exploit code or CISA KEV listing has been identified, though the network-accessible nature and low attack complexity represent meaningful risk in home and SMB environments.
Unauthenticated remote access to a production-enabled debug web server on Ecovacs DEEBOT PRO M1 and K1VAC robot vacuums exposes sensitive floor map data and operational logs to any network-reachable attacker. The flaw (CWE-489: Active Debug Code) means the devices ship with a debugging HTTP interface left enabled, serving home layout and usage data without any authentication gate. No active exploitation has been confirmed and no public exploit exists, but the CVSS 4.0 score of 8.7 reflects the high real-world privacy impact of floor plan exposure - a detailed map of a victim's home interior.
Remote unauthenticated control of Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums is possible due to an incorrectly implemented authentication algorithm in their WebSocket communications interface. Any network-reachable attacker can connect to and issue operational commands to affected robots without valid credentials (AV:N, PR:N per CVSS vector). No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Man-in-the-middle interception of ECOVACS PRO app traffic is possible due to improper TLS server certificate validation (CWE-295) in both the Android and iOS versions of the application, published by ECOVACS Robotics and coordinated by JPCERT under JVNVU92804348. An attacker with a network-positioned MITM capability can present a rogue certificate that the app accepts without proper validation, enabling retrieval and alteration of all app-server communications, which may include device control commands, account credentials, and home telemetry. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Weak Wi-Fi hotspot credentials on Ecovacs DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums allow a physically proximate attacker to recover the access point password through analysis, then connect to the robot's local network interface. Reported by JPCERT/CC via JVN advisory JVNVU92804348, this affects all firmware versions of both models per CPE data. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the low exploitation complexity combined with zero required privileges makes unauthorized Wi-Fi access straightforward for any attacker within radio range.
Weak preconfigured root credentials on Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robotic vacuum cleaners expose the root account to compromise via physical access. An attacker who obtains physical access to an affected device can recover the root password, gaining privileged control over the embedded Linux system. Reported by JPCERT and disclosed via JVN advisory JVNVU92804348, no public exploit code exists and no active exploitation has been confirmed at time of analysis.
Improper TLS certificate validation in Ecovacs Robotics DEEBOT PRO M1 and K1VAC robot vacuums exposes both devices to man-in-the-middle interception and manipulation of all outbound wget communications. Because certificate verification is disabled, a network-positioned attacker can impersonate any remote server the device contacts, injecting malicious content the device will accept and act upon. Per the vendor description, successful exploitation may result in arbitrary code execution with administrative privileges on the device; no public exploit has been identified at time of analysis.
Improper certificate validation in DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes MQTT communications to man-in-the-middle interception, allowing unauthenticated network-positioned attackers to retrieve operation logs and activity logs stored on the devices. Both models from Ecovacs Robotics fail to verify server certificates during MQTT sessions, meaning a rogue server can impersonate the legitimate cloud backend without detection. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor advisory with remediation guidance was published on 2026-03-31 as referenced by JPCERT.